Assume that we have a stream (call it STRM) and a pipeline (call it PLPLN)
consisting of the sole rule (RL):
rule "test rule for STRM"
when
true
then
set_field("test_STRM","tes_key1");
end
I thought it meant that any messages routed to STRM will be processed by
PLPLN. It will not be processed by pipelines connected to a default stream.
But in practice it does not work that way. I have another pipeline with a
similar rule:
rule "test rule"
when
true
then
set_field("test_set_by_rule","set_by rule: test_rule");
end
Now, even if the message satisfies the STRM rules and is routed to it, the
stream connected to a default pipeline is still applied. Moreover, the
PLPLN connected to STRM which the message is routed to IS NOT APPLIED.
Why? Or what does it mean to connect a pipeline to a stream? Is it a bug?
I made sure that the message is routed to STRM. It was indicated by this
sign:
Routed into streams
- STRM <http://0.0.0.0:9000/streams/57c81aba4cedfd000116346f/search>
on the search page.
I use *graylog v2.1.0-beta.2-ffa3355*
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/9da785cf-7579-414c-a727-21dc970f76a3%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
